Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/05/2026, 20:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe
- Size 1.7MB
- Sample260506-zqcssaex3n
- SHA256 a31938834b6a3eef5d2789e2bab406ee5091d849ee1e6b7c5e8845afd6cc1dda
- MD5 6f9e91108a0f6716bc45522838732cad
- SHA1 33303cc7dd55463b6be02f6d6fd1a170aa042812
- SHA512 c7465a1d4310f30233736719e06ee5841d5bc6a96c9a2dd161c6133b91c5d28223c5ec29215714cef67351ad6211b7bcfd27297a3cab4421183c774492346b29
- SSDEEP 24576:4udsYmJnpM7vwsH+Qr41kYG5TBTL2uPiVzB5AbhxNky1ov6+D8H8x4KRY6KvL8l:4BYH2afPAgkMcxNU
- TLSH T134854A15B29E73F1CEC5A87028AEB3FE6E749F850B165BC3A318DE2855223D2943715C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe - Executes dropped EXE 2 IoCs
pid Process 5344 Logo1_.exe 2976 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\pingsender.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\RCXC176.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\PilotshubApp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCXCC78.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\RCXD1E3.tmp Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\RCXD204.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\dotnet.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\RCXCE90.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe.Exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zG.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe File created C:\Windows\uninstall\rundl132.exe 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe File created C:\Windows\Logo1_.exe 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe 5344 Logo1_.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4684 wrote to memory of 5288 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 79 PID 5288 wrote to memory of 3532 5288 net.exe 81 PID 4684 wrote to memory of 784 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 82 PID 4684 wrote to memory of 5344 4684 2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe 83 PID 5344 wrote to memory of 4364 5344 Logo1_.exe 85 PID 4364 wrote to memory of 5076 4364 net.exe 87 PID 5344 wrote to memory of 1952 5344 Logo1_.exe 90 PID 1952 wrote to memory of 5244 1952 net.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:3532
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a342A.bat2⤵
- System Location Discovery: System Language Discovery
PID:784
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:5076
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:5244
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2976
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXCCA7.tmp
- Size 156KB
- SHA256 20df0a9ce97c311c4881fd6a27e9fb3d4759d94861acbc680179f06de893fd1d
- MD5 257eea7c86ab7768972537c5b1d6c217
- SHA1 403d6bacb1adb0e208be0cefe0991ed1191bc85f
- SHA512 2cce44ac7b2473174af4427cf7e1153d89b48ed3b5967c29873a0238fa289619bbdd24b2f23f777fd1df6fa885e542a01019142039bb8737367d4079496232e6
- SSDEEP 1536:w7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx58SXzpn9t6QNz:hCSjGoLpWM6VsBEjx5Zd5Z
- TLSH T126F3A36EB14EB3F6D3E1597C8D1CF295ED28FE20CE19285B75993B0EDA760C34508291
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXCE6F.tmp
- Size 94KB
- SHA256 4b0d1c60b387559eea88d77dc98803aa3b32d6a8e5485e4720b0011ecc0712d4
- MD5 28041a258773976372466312a873bc98
- SHA1 a1eb5e1d85cb4bf0fe021a5094cd3063a8ded835
- SHA512 40390d992435bf93ec8200b67397f265f8b0e87b2601ce7ba2eb0795c8923aba594c40fb160b80e7a3c65108f685e04e646d22906923c6a5c0fa01a8872e2ce1
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6fND:gCSjGoLpWM6VsBEjx+Zdqp
- TLSH T1C393295AB19CB3B2D0E199BD8E0FF2E5BD297E200E1D189F71993F0DEE76181590C285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXD17E.tmp
- Size 103KB
- SHA256 6dafbe3aba7bfa41693e20c7cbaf2c13237f3bdfc8933027e1fa3b74cb44b40d
- MD5 fed99c95935ea3ca7562f8f8bf8b7f04
- SHA1 6ced210ff5e681eaac536da8afcc1484edc5b03f
- SHA512 69718950f442d9bc4599e9b6593a6d0a903e54c674addc954e421208c924daf72d00353f48494aac50730fcf8f2efecd2424e7d46b772bc42b116a1497f9ca17
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx78SXzpn9t6M1XkSPsULMHixNQ:gCSjGoLpWM6VsBEjx7ZdddtPlLqcu
- TLSH T16CA36B19B68DB772D0E199B88E0DF2E5BD387E300F1A185FB59E3F0D9A765C1190C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCXD1C0.tmp
- Size 91KB
- SHA256 e94597c853343c9eace980ab893fca946167457ac4031b95611df74fe879a84d
- MD5 e20f61117bf42210a228b75b46f46be5
- SHA1 e8012f1c6712f66e4c46c3ad5b786fcb464d884c
- SHA512 57e86653f9954138f23ff7a6ad15034ffd9d29782f27c3afe6ea32517c1f04fa3083d5f120029b4130a84c524298c5416744a6d655fe9139d9d6f68170561a53
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxZ8SXzpn9t6wNT:YCSjGoLpWM6VsBEjxZZd55
- TLSH T19D935C5AB28DB372D0E299B88E0DF2E5BD387E300E1A185FB59E3F0DDA761C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe.Exe
- Size 4.0MB
- SHA256 4fd202524530bea11feb233636be26c84af70af8a3e34a68d11cbe0598dc7cee
- MD5 b5f2ff87a8d703991e1a867c5e067581
- SHA1 735ff4c3bf8c478ca53f69d3b62497ff68278e9f
- SHA512 a4387f45e94b4693a534e345d17459cd144476e0ab7a5097d2070d9561bbf9de776d75b04c5c02f5fb0fb05599c976954b1006061fd80276fc9cd45000305241
- SSDEEP 49152:RudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:DijnUdYd+RaAj
- TLSH T16C164903B29D62D4D089C074CE5AA232AF617C8947F161EF3690B7DA2A73AD47B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\RCXD28B.tmp
- Size 100KB
- SHA256 4d87571b2c3b3815c445c5331b0ea349d89408d36f92d725e8e05af23b6516ef
- MD5 721249ad3cf45f01d7f905d1c1697951
- SHA1 1313006a62ffbcb279032ac49a270693dc2a2fc3
- SHA512 ecff6cee97f3597e87ec4995773ddc8521cb05516e87b5252557a9a776792dbe27616bf7865d068671b82a4d92aed5080bf798bde16d532cd02052e255e7742a
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6eqkSZZZ3oNj:oCSjGoLpWM6VsBEjxQZdJUoJ
- TLSH T149A36C1AB69CB3B2D0F18AB89D0DF3E5BD397E300E5A185FB29D3B0D9A77181190C195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 bbc8ff8732592f68af61c79a88a38fa0a3bc5513fbd0518b9305d97cf47f59e4
- MD5 7199d85fd5ad19eadb0551a7c74b573e
- SHA1 76748c83276a8f1fe4b165842e61f2199ad82b89
- SHA512 62bdd968abe4de6b72c54cfe979ce366584065febde751c92c6f675748dd51a7287893c68d3d2ff440d1cb6db1d11f8063633024b7d8d3c77c12be3d2df660e9
- SSDEEP 6144:+XqoEwAXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ8F:nXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
- TLSH T146E40716F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286976C6E276E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCXC178.tmp
- Size 91KB
- SHA256 e4683d860309b8b5ecf7753772daf1a9eabb60f8e3119816f37c543a785124b5
- MD5 d4bf99fc50593ba3140fd3104709c192
- SHA1 b4aa53fa13b421c1741b36b2c6bc053b406a16ce
- SHA512 4963cff5009bfb9f32fe253eedecedc9587075a754ae6b2dd2e7db745b9745b380b5e5103fa0b141f11f97dc4ce65546184a26e028cfb61a2c3ac77b9a138720
- SSDEEP 1536:J7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxG8SXzpn9t6kNb:QCSjGoLpWM6VsBEjxGZdNB
- TLSH T1A0935B5AB68DB3B2D0E159B88E0DF1E5BD387E301E19185FB5AE3F0DDA761C1090C292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXC279.tmp
- Size 92KB
- SHA256 54369bc6aaf79e38be82abfd3669369859a86de6ae712517f8ffa757d504effc
- MD5 116a38ad9986fcbd171c381e57875fbc
- SHA1 c10436167652b6a474cfb651c917f1b6237d42c5
- SHA512 5cc38b604d8a757a95936f4b1a366239975b67b99df98bdd8e8106be979ce9f2e80ab2f2cde60fc0d7a1548795607d9f2b05b437ef172199dd38ffff3dc9e462
- SSDEEP 1536:57qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxe8SXzpn9t6RNL:gCSjGoLpWM6VsBEjxeZdox
- TLSH T1E4935B6AB29CB376D0E159B88E0DF2E5BD297E300E19185BB1AE3F0DDA771C1190C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCXC51E.tmp
- Size 91KB
- SHA256 785b6362283f80412ed302555cf860c5431c86e6f379fdec2808994a5e81f1ff
- MD5 e091392a3f5d59e07ed8f971146bcd6b
- SHA1 a1b6ec6eb3b9dd474a9725846370222a77a67640
- SHA512 8e869f518de943dc08e1aced7362fe0f37409cbcd117157f10c980bbf244ea7dd0e73df78db7d8518b41ccf191b2ee4b0a2fa9b7db24270fb51da8a083726afb
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxm8SXzpn9t62NL:YCSjGoLpWM6VsBEjxmZdjx
- TLSH T1B2934C59B29CB376D0F1A9B88E0DF2E5BD297E300E1A185BB5DE3F0DDA7A1C1190C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VideoLAN\VLC\RCXC551.tmp
- Size 92KB
- SHA256 a5d79e5d6583e248ebf69895244cc5cd281bd5a92af52f0c7dcb5fc22217a72a
- MD5 46474e174ae2790fa5d500c83b25d3de
- SHA1 c8cfe589ab53e83807e28715fe44a54d079a385d
- SHA512 5c738fffa2d348fa1847a8343cef5723c1ca06a8c931e8e9820cf1bed888b6af3431d77dea6740f7a73712db54fe77a81a44577fab64c0d5e1af78a1f5b42eac
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjx+8SXzpn9t6WND:YCSjGoLpWM6VsBEjx+ZdPp
- TLSH T14B933A65B29CB376D0EE59BC8E0DF2E5BD297E300E19085B719E3B0DDA7A1C1190C29D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a342A.bat
- Size 680B
- SHA256 4640727180dc0073237dfa4c635405f820edd0b09cc7a7d28dc70c47ea0e2a40
- MD5 84482c43b4bdc5383fc55a25b274d74e
- SHA1 d89dde69b358fa7bf2512fb31763806bce8545c6
- SHA512 e7d58627d189db1d89769fb1e70e3abf865b00ec0f9e65ea46ff80015a19ee15fbdca6a1fc30c516dd9f46c913008bfe70666d3b90d5b37840eed24596ee48d9
- TLSH T186016255C1BA8A3B29C7E12B6BE06F8FC0317D24FE191F483721858D60D095CB7AAB81
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-06_6f9e91108a0f6716bc45522838732cad_elex_wannacry.exe.exe
- Size 1.7MB
- SHA256 c4ef48cd0666ce447131d436fa62977a84420036eafa8187267c9b8a47a944f7
- MD5 cbd225bdf23bbe9cd10c521d734dc837
- SHA1 be0aea31f1358b13aed0c641e779aaa898b8d0d8
- SHA512 9425d731bd1c55b04344b5e24b6ab95e03c7f78e9391ed7aa267b2ae3d6b2a76792be8cea8b3b1fe8f2395611c6a4616974d986342c065726dac54fa32b958a5
- SSDEEP 24576:gudsYmJnpM7vwsH+Qr41kYG5TBTL2uPiVzB5AbhxNky1ov6+D8H8x4KRY6KvL8l:gBYH2afPAgkMcxNU
- TLSH T140855C15B29A41F1CE45A87028EEF7FE66749B890B1A9FC3A318DE3C55723D2A43711C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 5f97c528054fcbef8a09843af93b5cf5a9615952ec5d710339240b892f58ca74
- MD5 392061a0663b2f3b79ee9fc5767d5b6b
- SHA1 941c618bf0267ba597e603dac267ff9fcf56a52f
- SHA512 47de79d370caedc036e63fd37c6b78ab58273e550789e7f9b27c73a9bc004de5c743684fb59d10f96e403cef004328fab9e4652135dfdcc5014488a433145e8f
- SSDEEP 1536:h7qnkAQtSaoGo5n4iLG0/WM6TJmHSaYqeyEjxQ8SXzpn9t6pN:ICSjGoLpWM6VsBEjxQZdc
- TLSH T142935B6AB29CB776D0E199B88E0DF2E5BD287E300E1A185FB59E3F0DDA771C1490C191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH